ThreatFox IOC Database

You are browsing the Indicator Of Compromise (IOC) database of ThreatFox. If you would like to contribute IOCs to the corpuse, you can do so through either the web form or the API.

481

IOCs shared (past 24 hours)

VShell

Most seen malware family (past 24 hours)

1'775'691

IOCs in corpus

Using the form below, you can search for malware samples by a hash (MD5, SHA256, SHA1), imphash, tlsh hash, ClamAV signature, tag or malware family.

Browse Database

Search syntax is as follow: keyword:search_term

Following is a list of accepted keywords along with an example search_term

ioc:ms-debug-services.com ( run)
malware:CobaltStrike ( run)
tag:TA505 ( run)
threat_type:cc_skimming ( run)
uuid:87f310f3-540b-11eb-922c-42010aa4000a ( run)

Date (UTC)	IOC	Malware	Reporter
2026-09-05 20:17	fb839b28b8f9b49b61dc9b35affb963f1725079e972e1106306846ef7b708c56	DYEPACK	Grim
2026-09-05 20:17	c0b57b499e56e8696b3236a24fc3dc6873c5e545	DYEPACK	Grim
2026-09-05 20:17	f01dfc649a81fb32b73cbc2e341328b3	DYEPACK	Grim
2026-06-25 18:35	144a0a499e007931628c98f38929466f	DYEPACK	Grim
2026-06-25 18:35	0dc0fa727f900ed5033f46f8ba6cf2d97d20ab95fd334cabc0f216da6e0622b0	DYEPACK	Grim
2026-06-25 18:35	c7eccd855d2e97b57420afd23a4b9261f42f5b84	DYEPACK	Grim